Magic Bytes – Identifying Common File Formats at a Glance

Q&A with Splunk advisory CISO Doug Brush on why incident response evolves slowly, how SolarWinds-style TTPs are nothing new, and why cybersecurity mental health needs top-down prioritization.

Will Pearce shows that nulling the first bytes of a docm file lets spam filters deliver it despite block rules; Word's repair restores the file and the embedded macro still executes.

Forgotten files like database dumps and debug logs expand PCI assessment scope, trigger breach notification obligations, and undermine ISO reviews; organizations should locate and clean them up.

Trail of Bits documents the quirks uncovered while building a pure-Python cleanroom implementation of libmagic for PolyFile, from its arcane magic-file DSL to memory safety bugs behind numerous CVEs.

Trail of Bits engineers crafted a justCTF challenge exploiting PDF format quirks: a Ruby/PDF polyglot that runs as a script while rendering as a blank page, teaching steganography and forensic tricks.

Graphtage is a semantic diff tool for tree-structured files such as JSON, XML, and YAML: unlike line-oriented diff, it matches unordered structures and even compares across formats.